CBC mode works well for input greater than "b" bits. What is that "b" bits?

Question

This post on geeksforgeeks.org about block cipher modes of operation, says that one of the advantages of the CBC is that it works well for input greater than b bits. I also saw that in the book "cryptography and network security by William Stallings". But neither of them said what exactly is that b bits. Can anyone explain? thanks.

Answer 1

There the $b$ bits mean the block size of the Encryption and that is 64 for DES and 128 for AES.

Therefore you may need more than one block for the encryption of your plaintext (message). If your message size is $\ell$ than you need $$\lfloor \frac{\ell}{b} \rfloor + 1$$ blocks to encrypt.

The block nature of the CBC mode like any other, not like CTR, requires padding to fill the empty bits of the last block. Usually, the PKCS#7 padding is used for this. PKCS#7 can increase the number of blocks by one if $b|m$.

Note that if the CBC mode is used with servers like in TLS, then it is vulnerable to padding oracle attacks that work like decryption oracle. In this case, you may need to get rid of the CBC as TLS 1.3 did and use paddles mode like CTR. The better is using authenticated encryption modes like AES-GCM which internally uses the CTR mode and provides integrity and authentication with GMAC.

Keep in mind that, Wikipedia is the first source to look at those, not any other site.

If you really want to use CBC mode then

Your obligations

1. You must Generate a uniform random 256-bit secret key, and keep it secret all the time;
2. For each message that is going to be encrypted under the same key choose an Initialization Vector (IV) that must be unique and unpredictable. You can send the IV prepended to the ciphertext
3. Make sure that the message size is multiple of 128 with proper padding.
4. The message size must not exceed $2^{60}$.
5. The key must not be used more than $2^{45}$ due to the IV collision due to the birthday attack. This will produce $$(2^{45})^2/2^{128}/2 = 2^{90 - 128-1} = 1/2^{39}$$ probability of collision instead of $1/2$ probability of $2^{64}$

In return : CBC guarantees

1. CPA security; that is the adversary cannot distinguish two ciphertexts with the same length, and thus cannot read the message sent.

   That is all you get from the CBC mode if used properly. To achieve authenticated encryption use HMAC with CBC in encrypt-than-MAC as a recommendation.